what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

phpTrafficA 2.3 Cross Site Scripting

phpTrafficA 2.3 Cross Site Scripting
Posted Apr 8, 2015
Authored by Daniel Geerts

phpTrafficA versions up to 2.3 suffer from a persistent cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2015-2926
SHA-256 | 6001df596ab870db82b21681164b68c5ffaf1a407031673a71786b891c0a4bde

phpTrafficA 2.3 Cross Site Scripting

Change Mirror Download

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Product: phpTrafficA
Product page: http://soft.zoneo.net/phpTrafficA/
Affected versions: Up to and including 2.3 (latest as of writing).

Description:
The user agent string provided by the browser is not sanitized nor
escaped when handled. This string is then outputting into HTML code on
the "Latest visitors > Details" page, leading to HTML injection that can
be abused to perform XSS. For example, the following user agent will
cause a JavaScript dialogbox to pop up as soon as the page is visited:
"><script>alert();</script>

This page can be hidden from the public, in which case only admins can
visit it. However, the script still executes when they do, which could
enable a malicious user agent to steal the phpTrafficA cookie (no
expiry) or other admin credentials.


Proposed fix:
Escape the HTML characters with htmlspecialchars before outputting the
user agent string.

In: Php/stats/statsRecent.inc.php

Line 304:
echo "<tr class=\"data av $even $clrobots $clreturn\"><td
nowrap>$end</td><td>&nbsp;$dur</td><td
align=\"center\">&nbsp;".format_float($hits)."&nbsp;</td><td>&nbsp;<a
href=\"./index.php?mode=stats&sid=$sid&show=clickstream&lang=$lang&ip=$ip\"
title=\"".$strings['Moreinfovisitor']."\"
class=\"basic\">$ipText</a>&nbsp;</td><td
align=\"center\">&nbsp;".format_float($visits)."&nbsp;</td><td>".countryFlag($country)."</td><td>".osImg($os,'')."</td><td>".browserImg($wb,$agent)."</td><td>$page</td><td>$refString</td></tr>\n";
becomes:
echo "<tr class=\"data av $even $clrobots $clreturn\"><td
nowrap>$end</td><td>&nbsp;$dur</td><td
align=\"center\">&nbsp;".format_float($hits)."&nbsp;</td><td>&nbsp;<a
href=\"./index.php?mode=stats&sid=$sid&show=clickstream&lang=$lang&ip=$ip\"
title=\"".$strings['Moreinfovisitor']."\"
class=\"basic\">$ipText</a>&nbsp;</td><td
align=\"center\">&nbsp;".format_float($visits)."&nbsp;</td><td>".countryFlag($country)."</td><td>".osImg($os,'')."</td><td>".browserImg($wb,htmlspecialchars($agent))."</td><td>$page</td><td>$refString</td></tr>\n";


Line 369:
$echo = "<tr><td valign=\"top\" colspan=\"3\">$ip
($whoislink$baniplink)<br>$host<br>$labelTxt<table
class=\"basic\"><tr><td>".countryNameFlag($country)."</td></tr></table></td><td
valign=\"top\" colspan=\"2\">".$strings['Agent'].": $thisagent<br><table
class=\"basic\"><tr><td>".osImgName($os)."</td><td>".browserImgName($wb)."</td></tr></table>".$strings['Referrer'].":
";
becomes:
$echo = "<tr><td valign=\"top\" colspan=\"3\">$ip
($whoislink$baniplink)<br>$host<br>$labelTxt<table
class=\"basic\"><tr><td>".countryNameFlag($country)."</td></tr></table></td><td
valign=\"top\" colspan=\"2\">".$strings['Agent'].":
".htmlspecialchars($thisagent)."<br><table
class=\"basic\"><tr><td>".osImgName($os)."</td><td>".browserImgName($wb)."</td></tr></table>".$strings['Referrer'].":
";



Best regards,
Daniel Geerts
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJVJPGzAAoJEHn1bVIKHk5N5egP/0FRgNCiTwYyFwmqgcNLxOQ5
yuJtnGdGFvH0axXlvm+AgVYOtmM4erduSR3hCaSx4ER7f30SZkRCUuaW8aR1/Tow
bdYzLXNHcY21gXkhHt+bWH7ZkEpUWxXR6ZzrwL5QO3Ez+QkDr1HUmg8QQPUia8Qk
KGY+dbkRXqVR7MYRGjAbyceOEXpxpOtxaZ9UTSmQTGW31Upu+dmqkkOTbvV20tEj
N07T4UwMffCGNWloeuXg8QvIlvwe22kV3+frA2qGxdWKHVl66iJAV0pQ+bxDgoxe
Y3JsYKdeIhB6T0Yt7rpEbzlgaupQ9pg279bzGVVD4Z+AuNhvDY/4K6RZsFB11DGv
eY4VR8KLyNuw5N/wLBGf9ZSL9dLBGatYxi0HoQtrmFqLppo1x6nhEV6A0gRulWRa
9L04PdWKmv+2/prwW9ygT7UFIdApT1q3Uljq9QQIWmdDxGx3YxFmvMVpC5NThtxO
ElN8fhQpUKFss439qiLaGEMKO/D4bNC71Ydo6jvZOWQ+9eBxmMUT7XfK6fnB811c
RTRON1SG73AWcbfpIJ/dM+g0jm6bcvVVQxNmaARdlf+E2ihXnMPU2k39ndfV/vqD
7iuZQraH1ZrQJAqjVmzHWvEfEPyeaiJPRguu1kmnG8QkSMDtBHIpGvvHCHSU4ioF
+wxMYqlgbfJGakc4s5RO
=wCVy
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    18 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    7 Files
  • 23
    May 23rd
    111 Files
  • 24
    May 24th
    27 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    6 Files
  • 28
    May 28th
    12 Files
  • 29
    May 29th
    31 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close